The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains instructions intended to bypass platform-level restrictions. It explicitly directs the agent that skills marked with disable-model-invocation: true are "still readable" and should be followed by reading the file directly, which circumvents the platform's mechanism for preventing model-led invocation of specific tools.
[DYNAMIC_EXECUTION]: The skill utilizes dynamic loading with computed paths. It instructs the agent to construct file system paths at runtime using relative directory traversal and variables derived from the routing logic.
Evidence: Instructions to read <skill-dir>/../<route name>/SKILL.md and a fallback attempt to ../../<bucket>/<route name>/SKILL.md.
[INDIRECT_PROMPT_INJECTION]: The skill's core functionality creates an attack surface for indirect prompt injection. Untrusted user requests are used to determine which external instruction sets (SKILL.md files) are loaded into the agent's context.
Ingestion points: User-provided "situation" or request used to match a route.
Boundary markers: Absent. There are no instructions to the agent to treat the newly loaded content as untrusted or to ignore embedded instructions.
Capability inventory: The skill relies on the agent's file-reading capabilities to ingest content from the local file system.
Sanitization: Absent. The skill does not validate the integrity or content of the routed files before instructing the agent to follow them.

ask-atlas